octo | fb56fce6a6e5a24d46d830e3b2df8e87e76d76e805d704436396452b78441545

Analysis

max time kernel
20s
max time network
37s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
28-10-2024 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb56fce6a6e5a24d46d830e3b2df8e87e76d76e805d704436396452b78441545.apk
Size

8.0MB
MD5

e67fb8c2d6b6493e4bb143159a7c79b6
SHA1

bf0d0904b40c50c4b121d91a925213b472688c70
SHA256

fb56fce6a6e5a24d46d830e3b2df8e87e76d76e805d704436396452b78441545
SHA512

ce10a237c1d605513f62f283990a06b66f9ca08b1d25288750704a9cc4b4d664848810b146b0195dc8c72682f8763d5c1e1dc353469a155d5303f9dbbb99c916
SSDEEP

98304:dLjQZVA9tnkZ15iSRGRjVKx8v8eNeiL5WNDt4R2jN3X5RslEtmqWF:CbrYUGFLmp3X5Reqmb

Score

10^/10

octo banker collection credential_access discovery evasion impact infostealer persistence rat trojan

Malware Config

Extracted

Family

octo

AES_key

Signatures

Octo
Octo is a banking malware with remote access capabilities first seen in April 2022.
banker trojan infostealer rat octo
Octo family
octo

Octo payload 1 IoCs

resource	yara_rule
behavioral1/memory/4248-1.dex	family_octo

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.macatwatch89

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.macatwatch89/app_defy/NUhI.json	4274	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.macatwatch89/app_defy/NUhI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.macatwatch89/app_defy/oat/x86/NUhI.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.macatwatch89/app_defy/NUhI.json	4248	com.macatwatch89
Anonymous-DexFile@0xc82f8000-0xc837b5c0	4248	com.macatwatch89

Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.macatwatch89
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.macatwatch89

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.macatwatch89

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.macatwatch89

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.macatwatch89

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.macatwatch89

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.macatwatch89

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.macatwatch89

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.macatwatch89

com.macatwatch89
1⤵
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.macatwatch89/app_defy/NUhI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.macatwatch89/app_defy/oat/x86/NUhI.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4274

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.macatwatch89/.global.com.macatwatch89

Filesize
48B

MD5
046a414913add6f5bb60072c7db819b6

SHA1
451ee4f6809260aec622d772fd329c7d0297a842

SHA256
b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

SHA512
4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

Download Submit
/data/data/com.macatwatch89/app_defy/NUhI.json

Filesize
1006B

MD5
6e80494ff24ec5380155f18a42ad0366

SHA1
9c459d5e9b2fe4c58dd8fdfb36f0b46055145da2

SHA256
b692bb5bf224f4708a5d140abfb25a91afa29f8f05477b61e56073b0ac8c8462

SHA512
78ea5154b68026aca089f586ebfa57c5e6a671e820ccdb8bcc746f2e497fd80fce203ffc489f546ab3523532b7497a859eb553c63eaf2ae19521f42e0f1414ae

Download Submit
/data/data/com.macatwatch89/app_defy/NUhI.json

Filesize
1006B

MD5
851c55c35ed180e10a244aa6c7acd299

SHA1
2234f4a87c0cb7d718803c0c2a781856eb779874

SHA256
746b6ab7ed89214d9d4ac4da9301d940b2af133f3efb8a06545163307257007a

SHA512
388ebb3c3c4a7a313c794681bf5d9945d2975994ec692f65fe0528d746513fb242f6f82efeb4fa11b077d4e96e2f7c6a5b0698965ea3dadee6c5b003f9bf4261

Download Submit
/data/data/com.macatwatch89/files/.n

Filesize
307KB

MD5
4e73947cabb5db3f92ca85004981b754

SHA1
6d9667fdb0280ed2dcb782b4683e422a51bdc601

SHA256
6db94232e756b90ed437f1bc87dc38cf20fb2e7c7a19a5e40c6c17254b7e234c

SHA512
be8b500a7070af1dfb53b0cf1a7b327dadc4e163a6dad905496ac228c58cd1ed87b054533917924455d35e9b300683ae33e1bcdd91935a5dbae1d693c3e13d69

Download Submit
/data/user/0/com.macatwatch89/app_defy/NUhI.json

Filesize
1KB

MD5
2299a85b373ab9f8ce3b18333599b7c8

SHA1
b17875ebf7e3e19994fa299df1353aafd5ece3da

SHA256
9db24d358f487bfdc8f638f641a0e7901074b11fab04d814548526d106da77be

SHA512
4b9e985abb84968f5454f5a34a55a3bbd7ef65da2e87bfb1298ad77a2bcfe98019435e8cd31e00fb314f0928267179a57241d8a2f5eb11c3d5679ff4bbb62c6f

Download Submit
/data/user/0/com.macatwatch89/app_defy/NUhI.json

Filesize
1KB

MD5
1d488eba1583225ccedb64497978ae73

SHA1
80d731981459879310c767d834ea13d5c6c98da3

SHA256
c662e116e04c7885d687c783a2892f4b99c58ad70c85da6d6fb134573b1cb3ae

SHA512
a98268951cdb98fa4d4f4e36a6b01524f60f5901e5ce6c8fc094c697d26c82e47b0c087a21dfe33c0c6bfd7e7ddd69487253ca677a888468c635d8e7bd5d6723

Download Submit
Anonymous-DexFile@0xc82f8000-0xc837b5c0

Filesize
525KB

MD5
08b53ee512d3b6ce13eb199e0b41c5c0

SHA1
c99c4e17dfcb18c773561f805b35841f7fc89f8f

SHA256
55018b5d4baac31b800dc06d80fe59f1edaa87119a5770fce4981efeef2019ee

SHA512
297e0277d65662eef25f2bbc21ec6b590c1df7f70420983f443b7239cc8495b34e3e0e6347aea9ab1018f16dac7a7dedc603795ec5c4e2301cc979d12179ff19

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads